The patch titled blockdev.c: check driver layer errors has been removed from the -mm tree. Its filename is blockdevc-check-errors.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ Subject: blockdev.c: check driver layer errors From: Andrew Morton <akpm@xxxxxxxx> Check driver layer errors. Fix from: "Jun'ichi Nomura" <j-nomura@xxxxxxxxxxxxx> In blockdevc-check-errors.patch, add_bd_holder() is modified to return error values when some of its operation failed. Among them, it returns -EEXIST when a given bd_holder object already exists in the list. However, in this case, the function completed its work successfully and need no action by its caller other than freeing unused bd_holder object. So I think it's better to return success after freeing by itself. Otherwise, bd_claim-ing with same claim pointer will fail. Typically, lvresize will fails with following message: device-mapper: reload ioctl failed: Invalid argument and you'll see messages like below in kernel log: device-mapper: table: 254:13: linear: dm-linear: Device lookup failed device-mapper: ioctl: error adding target to table Similarly, it should not add bd_holder to the list if either one of symlinking fails. I don't have a test case for this to happen but it should cause dereference of freed pointer. If a matching bd_holder is found in bd_holder_list, add_bd_holder() completes its job by just incrementing the reference count. In this case, it should be considered as success but it used to return 'fail' to let the caller free temporary bd_holder. Fixed it to return success and free given object by itself. Also, if either one of symlinking fails, the bd_holder should not be added to the list so that it can be discarded later. Otherwise, the caller will free bd_holder which is in the list. Signed-off-by: Jun'ichi Nomura <j-nomura@xxxxxxxxxxxxx> Cc: "Randy.Dunlap" <rdunlap@xxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxx> --- fs/block_dev.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff -puN fs/block_dev.c~blockdevc-check-errors fs/block_dev.c --- a/fs/block_dev.c~blockdevc-check-errors +++ a/fs/block_dev.c @@ -543,11 +543,11 @@ static struct kobject *bdev_get_holder(s return kobject_get(bdev->bd_disk->holder_dir); } -static void add_symlink(struct kobject *from, struct kobject *to) +static int add_symlink(struct kobject *from, struct kobject *to) { if (!from || !to) - return; - sysfs_create_link(from, to, kobject_name(to)); + return 0; + return sysfs_create_link(from, to, kobject_name(to)); } static void del_symlink(struct kobject *from, struct kobject *to) @@ -648,30 +648,38 @@ static void free_bd_holder(struct bd_hol * If there is no matching entry with @bo in @bdev->bd_holder_list, * add @bo to the list, create symlinks. * - * Returns 1 if @bo was added to the list. - * Returns 0 if @bo wasn't used by any reason and should be freed. + * Returns 0 if symlinks are created or already there. + * Returns -ve if something fails and @bo can be freed. */ static int add_bd_holder(struct block_device *bdev, struct bd_holder *bo) { struct bd_holder *tmp; + int ret; if (!bo) - return 0; + return -EINVAL; list_for_each_entry(tmp, &bdev->bd_holder_list, list) { if (tmp->sdir == bo->sdir) { tmp->count++; + /* We've already done what we need to do here. */ + free_bd_holder(bo); return 0; } } if (!bd_holder_grab_dirs(bdev, bo)) - return 0; + return -EBUSY; - add_symlink(bo->sdir, bo->sdev); - add_symlink(bo->hdir, bo->hdev); - list_add_tail(&bo->list, &bdev->bd_holder_list); - return 1; + ret = add_symlink(bo->sdir, bo->sdev); + if (ret == 0) { + ret = add_symlink(bo->hdir, bo->hdev); + if (ret) + del_symlink(bo->sdir, bo->sdev); + } + if (ret == 0) + list_add_tail(&bo->list, &bdev->bd_holder_list); + return ret; } /** @@ -741,7 +749,9 @@ static int bd_claim_by_kobject(struct bl mutex_lock_nested(&bdev->bd_mutex, BD_MUTEX_PARTITION); res = bd_claim(bdev, holder); - if (res || !add_bd_holder(bdev, bo)) + if (res == 0) + res = add_bd_holder(bdev, bo); + if (res) free_bd_holder(bo); mutex_unlock(&bdev->bd_mutex); _ Patches currently in -mm which might be from akpm@xxxxxxxx are origin.patch git-acpi.patch acpi-preserve-correct-battery-state-through-suspend-resume-cycles-tidy.patch acpi-asus-s3-resume-fix.patch sony_apci-resume.patch kauditd_thread-warning-fix.patch git-block.patch git-block-fixup.patch git-block-hack.patch git-drm.patch git-dvb.patch git-geode-fixup.patch git-gfs2.patch git-ia64.patch git-ieee1394.patch git-input.patch git-intelfb-fixup.patch hdrcheck-permission-fix.patch git-libata-all.patch libata-return-sense-data-in-hdio_drive_cmd-ioctl-tidy.patch mmc-driver-for-ti-flashmedia-card-reader-source.patch git-mtd-fixup.patch git-netdev-all.patch forcedeth-power-management-support-tidy.patch drivers-net-ns83820c-add-paramter-to-disable-auto.patch revert-genirq-core-fix-handle_level_irq.patch git-parisc-fixup.patch git-parisc-powerpc-fix.patch git-pcmcia-fixup.patch git-serial.patch git-serial-fixup.patch serial-fix-uart_bug_txen-test.patch git-scsi-misc.patch git-block-vs-git-sas.patch git-scsi-target-fixup.patch git-scsi-target-vs-git-block.patch xpad-dance-pad-support-tidy.patch git-watchdog.patch revert-insert-ioapics-and-local-apic-into-resource-map.patch x86_64-dump_trace-atomicity-fix.patch arch-i386-pci-mmconfigc-tlb-flush-fix-tweaks.patch xfs-rename-uio_read.patch get-rid-of-zone_table-fix.patch radix-tree-rcu-lockless-readside.patch acx1xx-wireless-driver.patch tiacx-pci-build-fix.patch tiacx-ia64-fix.patch tiacx-build-fix.patch swsusp-add-resume_offset-command-line-parameter-rev-2-fix.patch deprecate-smbfs-in-favour-of-cifs.patch edac-new-opteron-athlon64-memory-controller-driver-tidy.patch add-address_space_operationsbatch_write-fix.patch maximum-latency-tracking-infrastructure-tidy.patch add-config_headers_check-option-to-automatically-run-make-headers_check-nobble.patch submit-checklist-mention-headers_check.patch generic-bug-handling-fix.patch use-generic-bug-for-i386-tidy.patch use-generic-bug-for-x86-64-fix.patch use-generic-bug-for-powerpc-fix.patch use-generic-bug-for-powerpc-fix-2.patch use-generic-bug-for-powerpc-fix-3.patch bug-test-1.patch list-module-taint-flags-in-oops-panic-tidy.patch ntp-move-all-the-ntp-related-code-to-ntpc-fix.patch reiserfs-on-demand-bitmap-loading.patch streamline-generic_file_-interfaces-and-filemap-gfs-fix.patch add-vector-aio-support-fix.patch csa-basic-accounting-over-taskstats-fix.patch fs-cache-make-kafs-use-fs-cache-fix.patch fs-cache-make-kafs-use-fs-cache-vs-streamline-generic_file_-interfaces-and-filemap.patch nfs-use-local-caching-12-fix.patch stack-overflow-safe-kdump-crash_use_safe_smp_processor_id-fix.patch generic-ioremap_page_range-x86_64-conversion-fix.patch vfs-make-filldir_t-and-struct-kstat-deal-in-64-bit-inode-numbers-alpha-fix.patch some-cleanup-in-the-pipe-code-tidy.patch support-piping-into-commands-in-proc-sys-kernel-core_pattern-fix.patch move-pidmap-to-pspaceh-fix.patch kprobes-handle-symbol-resolution-when-modulesymbol-is-specified-tidy.patch isdn-work-around-excessive-udelay.patch knfsd-add-a-callback-for-when-last-rpc-thread-finishes-tidy.patch knfsd-add-a-callback-for-when-last-rpc-thread-finishes-fix.patch knfsd-separate-out-some-parts-of-nfsd_svc-which-start-nfs-servers-tweaks.patch knfsd-define-new-nfsdfs-file-portlist-contains-list-of-ports-tidy.patch knfsd-define-new-nfsdfs-file-portlist-contains-list-of-ports-fix.patch knfsd-drop-serv-option-to-svc_recv-and-svc_process-nfs-callback-fix-nfs-callback-fix.patch knfsd-move-tempsock-aging-to-a-timer-tidy.patch knfsd-nfsd4-fslocations-data-structures-fix.patch sched-remove-unnecessary-sched-group-allocations-fix.patch swap_prefetch-vs-zoned-counters.patch ecryptfs-mmap-operations.patch ecryptfs-alpha-build-fix.patch ecryptfs-more-elegant-aes-key-size-manipulation.patch ecryptfs-get_sb_dev-fix.patch make-kmem_cache_destroy-return-void-ecryptfs.patch ecryptfs-versioning-fixes-tidy.patch namespaces-add-nsproxy.patch namespaces-utsname-switch-to-using-uts-namespaces.patch namespaces-utsname-switch-to-using-uts-namespaces-klibc-bit-sparc.patch namespaces-utsname-use-init_utsname-when-appropriate.patch namespaces-utsname-implement-utsname-namespaces.patch namespaces-utsname-sysctl-hack.patch ipc-namespace-core.patch rename-the-provided-execve-functions-to-kernel_execve-headers-fix.patch replace-cad_pid-by-a-struct-pid-fixes.patch readahead-sysctl-parameters-fix.patch make-copy_from_user_inatomic-not-zero-the-tail-on-i386-vs-reiser4.patch make-kmem_cache_destroy-return-void-reiser4.patch reiser4-hardirq-include-fix.patch reiser4-run-truncate_inode_pages-in-reiser4_delete_inode.patch reiser4-get_sb_dev-fix.patch reiser4-vs-zoned-allocator.patch reiser4-rename-generic_sounding_globalspatch-fix.patch hpt3xx-rework-rate-filtering-tidy.patch genirq-convert-the-i386-architecture-to-irq-chips.patch genirq-x86_64-irq-reenable-migrating-irqs-to-other-cpus.patch genirq-msi-simplify-msi-enable-and-disable.patch genirq-ia64-irq-dynamic-irq-support.patch genirq-msi-only-build-msi-apicc-on-ia64-fix.patch genirq-i386-irq-remove-the-msi-assumption-that-irq-==-vector.patch genirq-x86_64-irq-make-vector_irq-per-cpu-fix.patch genirq-x86_64-irq-make-vector_irq-per-cpu-warning-fix.patch add-hypertransport-capability-defines-fix.patch initial-generic-hypertransport-interrupt-support-Kconfig-fix.patch srcu-report-out-of-memory-errors-fixlet.patch isdn-debug-build-fix.patch isdn-more-pr_debug-fixes.patch nr_blockdev_pages-in_interrupt-warning.patch device-suspend-debug.patch slab-leaks3-default-y.patch x86-kmap_atomic-debugging.patch restore-rogue-readahead-printk.patch put_bh-debug.patch acpi_format_exception-debug.patch jmicron-warning-fix.patch - To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html